Legal
Subprocessors
Indraft is a processor for the customer data you put in it, and you are the controller. These are every third party that processes any of it. Adding one is a change to this page, not a deployment detail.
| Subprocessor | What it processes | Why |
|---|---|---|
| Cloudflare | All CRM data, at rest and in transit, and the email address we send service notices to | Hosting, application compute, content delivery, and the transactional email we send you about your own workspace. Your workspace data is stored and processed on Cloudflare infrastructure, and mail goes through Cloudflare's own service rather than a separate provider, so this list stays as short as it is. |
| WorkOS | Identity: user, organization, membership, and role | Authentication and MCP authorization. Indraft implements no passwords and issues no sessions of its own. |
| Stripe | Billing contact and payment data | Subscriptions, hosted Checkout, and the Customer Portal. No CRM record reaches Stripe. |
No model provider is on this list
That is not an omission. Indraft calls no language model in any code path, and an architecture check enforces it on every build. Your CRM records are exactly the kind of data that would otherwise end up in an inference vendor's logs, so the simplest way to keep them out is to have no such vendor at all.
The agent operating your CRM is YOUR agent, running wherever you run it. It reads and writes through our API; we never send your records anywhere to be summarised or classified.
Governing law
Illinois. O'Shea & Sons, LLC is an Illinois company.